Messages in this thread | | | Date | Thu, 24 Feb 2022 16:58:41 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v2 15/39] x86/ibt,kprobes: Fix more +0 assumptions |
| |
On Thu, Feb 24, 2022 at 03:51:53PM +0100, Peter Zijlstra wrote: > With IBT on, sym+0 is no longer the __fentry__ site. > > NOTE: the architecture has a special case and *does* allow placing an > INT3 breakpoint over ENDBR in which case #BP has precedence over #CP > and as such we don't need to disallow probing these instructions. > > NOTE: irrespective of the above; there is a complication in that > direct branches to functions are rewritten to not execute ENDBR, so > any breakpoint thereon might miss lots of actual function executions. > > Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> > --- > arch/x86/kernel/kprobes/core.c | 11 +++++++++++ > kernel/kprobes.c | 15 ++++++++++++--- > 2 files changed, 23 insertions(+), 3 deletions(-) > > --- a/arch/x86/kernel/kprobes/core.c > +++ b/arch/x86/kernel/kprobes/core.c > @@ -1156,3 +1162,8 @@ int arch_trampoline_kprobe(struct kprobe > { > return 0; > } > + > +bool arch_kprobe_on_func_entry(unsigned long offset) > +{ > + return offset <= 4*HAS_KERNEL_IBT; > +}
Let's avoid magic (though obvious right now) literal values. Can the "4" be changed to a new ENBR_INSTR_SIZE macro or something?
-- Kees Cook
| |